Android EUVD-2026-92607

Requires local code execution on the device - an attacker must already run a low-privileged app or process (PR:L) that can feed malformed input into the Bluetooth snoop logger's FilterCapturedPacket routine in snoop_logger.cc; no user interaction and no remote network path exist. Limiting factors: the attack vector is strictly local (AV:L), so the attacker needs an existing foothold on the device, and only Android 16, 16-qpr2, and 17 builds are listed as affected - devices patched to the 2026-10-01 security patch level or on unaffected versions are not exploitable. There is no indication a non-default Bluetooth configuration is required, so default Android deployments with the Bluetooth stack present are in scope.

Signals are largely consistent and point to a genuine but second-tier priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N) describes a local, low-complexity, low-privilege attack with no user interaction yielding total compromise (C:H/I:H/A:H), consistent with a local privilege-escalation bug in the Android Bluetooth stack (FilterCapturedPacket in snoop_logger.cc). The CISA SSVC framework reinforces a measured stance: Exploitation=none (no observed or public exploitation), Automatable=no (local-only, not mass-scannable), but Technical Impact=total (full compromise of the affected component), which aligns with the CVSS 7.8/HIGH. There is no CISA KEV listing and no public POC, so this is not evidence of active or widespread exploitation. The risk is real for a motivated local attacker - e.g., a malicious or compromised app chaining to kernel/system privileges - but it is not a drive-by remote threat. Note the local attack vector (AV:L) means this cannot be exploited remotely despite the HIGH score; prioritize via normal monthly Android patch cadence rather than emergency response. No key signals conflict; the main gap is the absence of granular affected-version/build detail beyond 'Android 16/16-qpr2/17' and the single vendor bulletin reference.

A malicious or compromised application already present on the device (requiring only low privileges) sends crafted or malformed data that reaches the Bluetooth snoop logger's packet-filtering path, triggering a memory-safety condition from improper input validation. Because no user interaction is required (UI:N), exploitation proceeds silently to escalate the attacker's privileges on the local device. No public exploit code has been identified, but the low attack complexity (AC:L) makes reliable exploitation plausible for a skilled attacker with device access.